Securely Virtualizating Network Services

ABSTRACT

Services in a network device are added through providing virtual environments. Virtualization allows services based on other platforms or architectures to be run with minimum modification and in a secure manner. Connecting services to the host through a stateful firewall allows dynamic integration, and passes only traffic of interest to the service. Virtualization allows services written for different instruction architectures to be supported. Multiple virtualized environments each supporting a service may be run.

BACKGROUND OF THE INVENTION

The present invention relates to adding network services to a system,and more particularly, to securely adding network services to a systemsuch as an embedded system through virtualization.

Systems builders, particularly builders of complex digital systems suchas network switches, network controllers, access points, and otherdigital infrastructure systems, often wish to augment the capabilitiesof their products.

One way to do this is to integrate third party software into the systemto provide additional capabilities. For the systems builder, thisapproach offers several advantages. It can reduce research anddevelopment time by integrating already existing software into aproduct, and possibly in areas where the systems builder does not havethe same level of expertise.

Such integration of third party software also poses significantproblems. Such integration usually entails retargeting the third partysoftware to a different system than that on which it normally operates;this requires access to source code. The third party developer may notwish to provide access to source code, or the systems builder may not beable to meet the financial expectations of the third party developer togain source code access.

Even if the systems builder can gain access to source code, that codemust be ported and made operational in the systems builder's targetenvironment. A number of factors may collude to make such a portexciting. The third party developer may not be willing or able toprovide detailed technical support for such a port, or the systemsbuilder may not be willing to pay the developer for the supportrequired. Additionally, the third party code may not have been writtenwith porting in mind, may contain significant dependencies on thesystem/architecture for which it was developed, and may not becompletely documented.

Once a port has been accomplished, additional difficulties are stillpresent. Does the ported third party code play well with the remainderof the system? When issues such as bugs are discovered with the serviceadded by the ported third party code, are the bugs in the third partyservice, or were they introduced by the porting effort? How are upgradesand bug fixes to the third party service to be handled?

BRIEF DESCRIPTION OF THE DRAWINGS

The invention may be best understood by referring to the followingdescription and accompanying drawings that are used to illustrateembodiments of the invention in which:

FIG. 1 shows a block diagram of a hardware device,

FIG. 2 shows a diagram of the OSI seven layer model, and

FIG. 3 shows a device environment including virtualization.

DETAILED DESCRIPTION

Embodiments of the invention relate to securely adding services to anetwork device through virtualization. According to one embodiment ofthe invention, virtualization software running on the host provides avirtual environment hosting the third party service. The virtualenvironment may provide a virtualized device and instruction setarchitecture different than that provided by the host. Hosting the thirdparty service in a virtual environment isolates the service from otherservices on the host. By connecting the virtualized third party servicethrough a stateful firewall, only data needed for the service is passedthrough the firewall to the service. Multiple services may be providedby multiple virtual environments running on the same host. Servicesprovided through virtual environments may be cascaded with otherservices on the device, both native and virtualized.

FIG. 1 shows a block diagram of a typical network or embedded devicesuitable for practicing the invention. Device 100 connects 20 to network10. Device 100, which may be a switch, a router, or other networkservice provider, contains a central processing unit (CPU) 110, memoryhierarchy 120, and network interface 130. Device 100 may also includeadditional network interfaces 140, 150. Network interfaces 130, 140, 150are typically Ethernet interfaces, and may be wired Ethernet such as10/100/1000 Mbit interfaces, wireless interfaces according to the 802.11standard, or other suitable digital interfaces known to the art. Networkinterface 130 may also be a wired interface such as a cable or DSLmodem, or a wireless connection such as WiMAX or EDGE. CPU 110 may be anIA86 processor such as those from Intel (Xeon, Pentium, Core 2, Celeronfor example), AMD (Sempron, Athlon for example), or VIA, a PowerPCprocessor such as those from IBM or Freescale, or a MIPS processor suchas those from MIPS, Cavium Networks, or Raza Microelectronics. As isunderstood by the art, memory hierarchy 120 includes high-speedread-write memory such as DRAM, persistent memory for system startupsuch as a form of read-only memory (ROM, EPROM, Flash ROM), and bulkmemory such as compact flash or hard disk. One suitable hardwareenvironment uses a MIPS64 processor from Cavium Networks for CPU 110,256 Kb of flash memory, 32 to 512 Mb of DRAM and 256 Mb-4 Gb of compactflash bulk storage. This hardware platform runs under the control of aLinux kernel. Other operating software such as VxWorks from Wind Rivermay also be used. Services are provided as tasks or processes running onthe underlying operating system.

A basic understanding of the OSI 7 layer network model as known to theart is useful. A diagram of the OSI 7 layer model is shown as FIG. 2.The OSI model provides a useful hierarchical view of network operations.In such a model, each layer only communicates with the adjacent layers.Various interface standards set the protocols used in the communicationsbetween layers.

Layers 1 through 3 are concerned with data transfer through the networkmedia. Layer 1, the Physical layer, deals with signaling and moving bitson the medium, such as wired or wireless Ethernet. Layer 2, the DataLink layer, deals with frames and physical addressing. Layer 3, theNetwork layer, deals with packets, logical addressing, and pathdetermination.

Layers 4 through 7 are the host layers. Layer 4, the Transport layer,deals with data segments and providing end-to-end connections andreliability. Layer 5, the Session layer, deals with inter-hostcommunications. Layer 6, the Presentation layer deals with datarepresentation and encryption. Layer 7, the Application layer, providesservices to end user applications such as web browsers, e-mail services,and the like.

According to FIG. 3 and an embodiment of the invention, packet data oninterface 50 is processed by network stack 300. Network stack 300interfaces with firewall 310, and example services 320, 330, and 340.While network stack 300 and firewall 310 may be implemented in softwarerunning on CPU 110, it is common in the art to use varying levels ofhardware acceleration to accomplish these tasks. Firewalls and statefulfirewalls are known to the art. Open source firewalls are available fromIPCop, IPFW, and many commercial products are available as well.Firewalls operate by inspecting packets flowing through them andapplying a set of rules which determine if a packet is to be passedthrough the firewall, or not passed through. A stateful firewallmaintains context on connections between clients on either side of thefirewall, allowing packets associated with active connections to passthrough, and inspecting packets and applying rules to establish andterminate connections.

As shown in FIG. 3, services 320 and 330 are native services directlysupported by CPU 110. Examples of services include but are not limitedto intrusion detection and prevention (IDS, IPS), packet scanning,bandwidth shaping, measurement functions, honeypots, security services,authentication services, network time servers, and the like.

In the case of a service which is not available, for example, to be runon a native MIPS64 platform, virtual machine 350 may be used to providea virtual environment to host service 340. As an example, consider anIPSec service available for IA86 architectures. Virtual machine 350 maybe used to provide the required IA86 virtual environment. An open sourceprocessor emulator suitable for virtual machine 350 for IA86 systems isavailable under the GNU General Public License from QEMU. An additionalopen source cross-platform PC emulator is available from Bochs, hostedon Source Forge. Virtual machines and virtualization is understood inthe art with commercial products available from corporations such asVMWare. A virtual machine provides not only the instruction set, butalso the entire virtualized platform: instruction set, memory, diskdrives, network interfaces, and so on, so that the third party servicethinks it is running on its native hardware.

By configuring firewall 310, only data packets of interest to service340 are provided, protecting service 340 from unwanted traffic. As anexample, a network time service operating as service 340 is onlyconcerned with UDP traffic on port 123. Firewall 310 may be configuredto route UDP traffic on port 123 to time service 340, and to only allowoutput UDP traffic on port 123 from time service 340. In the case ofother output traffic from time service 340, firewall 310 may be set toignore (drop) such traffic, or to signal such an event as an anomaly,through steps such as event logging, or raising an exception.

To simplify the process of integrating third party software/services,Virtual machine 350 may also be used to provide a virtual environmentreplicating a desired physical device, as an example, the Riverbedhardware platform from Riverbed Technology. By providing a virtualizedRiverbed platform, any software released for Riverbed may be supportedon the device. Similarly, a virtual machine 350 may be used to provide avirtual environment replicating a basic IA86 based computer, includingnetwork connections, to support software services written for thatenvironment.

By connecting virtualized services through stateful firewall 310,virtualized services dynamically integrate into the host. The guestservice requests specific traffic, and that traffic, and only thattraffic is provided to the guest service running in the virtualenvironment.

A single virtual machine 350 may support multiple services 340. As anexample, a single virtual machine may support a time server and adatabase server such as SQLite.

Multiple virtual machines 350 may be present, providing multiple virtualenvironments for services 340. When operating on a multi-core ormulti-thread CPU 110, such as those from Cavium or Raza, it may bebeneficial to dedicate threads and/or cores to virtualization services.

Since guest services run in virtual environments, any number of suchservices may run on the same host device. Such services may be combinedand cascaded, for example, an intrusion detection—intrusion preventionservice (IDS/IPS) would receive all requested traffic prior to thattraffic being forwarded on to other services, such as virus scanning.

Providing virtual environments for services severely constrains theresources available to those services, providing isolation betweenservices, and isolation from the host, providing additional security forservices such as FIPS certified ciphers, or for services which areexpected to be compromised, such as honeypots. The compromise or failureof a service in a virtual environment need not affect other services onthe device.

While the invention has been described in terms of several embodiments,the invention should not be limited to only those embodiments described,but can be practiced with modification and alteration within the spiritand scope of the appended claims. The description is thuis to beregarded as illustrative rather than limiting.

1. A method of adding a network service to a host device comprising:providing a virtual environment for the service, executing the servicein the virtual environment, and connecting the service to the devicethrough a firewall in the host device.
 2. The method of claim 1 wherethe firewall is a stateful firewall.
 3. The method of claim 1 where thevirtual environment provides the same instruction set architecture asthe host device.
 4. The method of claim 1 where the virtual environmentprovides a different instruction set architecture than the host device.5. The method of claim 1 where the virtual environment provides an IA86instruction set architecture.
 6. The method of claim 1 where multipleservices are executed in a single virtual environment.
 7. The method ofclaim 1 where multiple services are executed in multiple virtualenvironments.
 8. A method of adding a network service to a host devicehaving at least one native network service, comprising: providing avirtual environment for the service to be added, executing the serviceto be added in the virtual environment, and connecting the service to beadded to the device through a firewall in the host device.
 9. The methodof claim 8 where a native service and the service to be added arecascaded.
 10. A machine readable medium having a set of instructionsstored therein, which when executed on a host device cause a set ofoperations to be performed, comprising: providing a virtual environmentto the host device, executing a network service in the virtualenvironment, and connecting the network service through a firewall inthe host device.
 11. The machine readable medium of claim 10 where thevirtual environment provided has the same instruction set architectureas the host device.
 12. The machine readable medium of claim 10 wherethe virtual environment provided has a different instruction setarchitecture as the host device.
 13. The machine readable medium ofclaim 10 where the virtual environment provided has an IA86 instructionset architecture.
 14. The machine readable medium of claim 10 furthercomprising executing multiple network services in a single virtualenvironment.
 15. The machine readable medium of claim 10 furthercomprising providing multiple virtual environments each virtualenvironment capable of hosting at least one service.